neshta | 61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623

General

Target

61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
Size

40KB
MD5

2f7dfc1d02eeeaabbd8a7e708e9c3666
SHA1

ce80ac8c5fd4c928980e43b6488b94e850a439ec
SHA256

61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623
SHA512

050ffa46031aab5e8890661e41ecb96a2f16e6ce57c0e9bbe5c6f827b526a7acd6754ead8ec5d6be1d5f069006d462d0f2d5cff20cd736e651b5be56fb0567a6
SSDEEP

768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJRBb0d:JxqjQ+P04wsmJCaAd

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI391D~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~2.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~4.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13165~1.21\MICROS~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MIA062~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~3.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI9C33~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe

Drops file in Windows directory 1 IoCs

Processes:

61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe

description ioc process

File opened for modification C:\Windows\svchost.com 61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe

Modifies registry class 1 IoCs

Processes:

61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe

C:\Users\Admin\AppData\Local\Temp\61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe
"C:\Users\Admin\AppData\Local\Temp\61d4bf0f47de1e1bdc4cbb5e44b9e0c6df1301e3c49d52b1c21d56c669e4e623.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:5032